Password and confirm password should be mandatory fields while setting up password using one time link following by email

Converting this to an MR is a suitable for a novice, leaving the tag.

Can somebody test what I have done? This is my first ever commit to Drupal. :)

Hiding old patches and files

Issue summary appears complete so removing that tag.

Ran test-only feature and it failed but didn't output a failure so ran locally

Behat\Mink\Exception\ResponseTextException: The text "Password field is required." was not found anywhere in the text of the current page.
/var/www/html/web/vendor/behat/mink/src/WebAssert.php:907
/var/www/html/web/vendor/behat/mink/src/WebAssert.php:293
/var/www/html/web/core/tests/Drupal/Tests/WebAssert.php:979
/var/www/html/web/core/modules/user/tests/src/Functional/UserPasswordResetTest.php:143

Looking at the change to core/modules/user/src/AccountForm.php and comment helps and makes sense to me.

believe this is good.

#58 asks a good question. Here's one answer. Because if they are not required and you use the 1 time login and then save the account without entering a new password it'll save and the resulting form will have the current password field. But you don't have a current password if you've come directly from an email sent due account registration so this is then an impossible task. So I think this change makes sense.

I think this is probably fine.

There is a use-case for password reset links where people create a password, don't try to remember or it use a password manager for it, then use reset links each time. drush uli is a similar use-case during local development too.

However, because our password reset links also log you in, making the fields required won't break this - e.g. you can click the link, ignore the form, same as you previously did.

alexpott → credited sugaroverflow → .

Given this is an allowed change but to a majorly important form I'm only going to make this to next minor branches and not to the patch. branches (10.3.x and 11.0.x)

Committed and pushed 0b78493d29a to 11.x and 27f7b679085 to 11.1.x and 4027f70a0ec to 10.5.x and deead9fdad7 to 10.4.x. Thanks!

Automatically closed - issue fixed for 2 weeks with no activity.